[ScriptedAlchemy]

Why

Each producer had its own four-child compiler pool and effectively unlimited subprocess capture. Concurrent project producers did not share their child capacity.

What changed

• Mount one compiler admission in the daemon generation and reuse the installed background CPU authority. Keep both permits until the existing child supervisor settles.
• Replace eager per-run semaphore tasks with a bounded lazy stream. Close queued and running work with daemon admission.
• Refuse checks after 20 minutes, 64 MiB stdout, or 1 MiB stderr. Preserve typed failures, partial findings, generation reuse, and cancellation on drop.

Scope

Fixes #4439. Parent link is #4545 on simplify/diagnostics-project-compiler-status.
The project-owned status cutover remains intact. Compiler-owned configuration evidence in #4440 and operation retirement in #4403 remain separate links. This change does not modify #4524.

Tradeoffs

The existing background CPU authority meters active compiler work. A daemon-owned semaphore additionally bounds live compiler children without another scheduler or a process-global registry. No RSS reduction or production budget calibration is claimed.

Blast Radius

Automatic project-pinned TypeScript diagnostics now share daemon admission. A stalled or excessive-output compiler fails rather than publishing clean evidence. Retrieval still reads generation-bound publications without running a compiler.

Verification

• Bazel LSP compiler tests passed 25, including wait/run cancellation, child settlement, stdout and stderr refusal, and 1,000 valid findings. Formatting passed for all affected crates.
• Bazel application producer/publication/store/availability tests passed 37. Three isolated producers performed nine checks under the shared four-child limit and retained partial findings.
• Bazel supervisor and CPU tests passed 16. Daemon shutdown tests passed 3. Scoped Clippy passed for all three affected unit targets with warnings denied. The macOS test link reported existing unwind-size warnings.

---

Held ASK

Devin thread on scheduler.rs stale-lock admission (stale_lock_secs vs unverifiable owner) is a concurrency/lock-admission question. Left open for the operator: remove the obsolete setting, or carry the configured bound into the legacy-owner decision. Not implemented here.

Current-head CI failure repairs

The Linux fleet run 40437266717 completed 169 of 171 targets successfully. This follow-up repairs the two failed journeys without changing their budgets or dropping existing assertions.

The retained-route journey reopened a project after a sibling changed configuration. The old Work runtime rejected the same store authority before the compiler producer could register. Registration now refreshes policy, topology, routing, and evidence admission together, fenced by the captured incumbent and the canonical current configuration. Exact store, actor, grant, scope, and Work authority remain required. The retained fan-out recovery view receives the same admission update without replacing recovery owners or creating an owner cycle. The real journey now also checks stable grant identity, the current registration, refusal of stale or sibling registrations, and preservation of the current authority after refusal.

The pending-compiler fixture held its real compiler until the test could release it, but setup waited for lexical publication first. Source inspection establishes a reachable CPU admission/readiness cycle consistent with the small four-file CI fixture stalling after index build; this is not a measured occupancy claim. The fixture now uses the existing production opener, proves compiler startup before the unchanged typed pending assertions, releases the compiler, then requires graph readiness and the published TS4023 finding. Workload, polling bounds, and existing result checks are preserved.

Both focused commits passed pinned formatting, whitespace checks, normal pre-commit/commit-msg hooks, and independent source review. The complete native journeys were not run locally because of disk and memory constraints; the new head must pass hosted CI.

Configuration publication race follow-up

A changed retained Work runtime now verifies and publishes its configuration under the configuration store's existing canonical writer lane. The store reads durable current state through a registered immediate transaction, revalidates its retained authority, and invokes a synchronous registry transition before releasing the lane. The captured-incumbent comparison remains in place to prevent a delayed registrar from replacing a newer installed runtime.

The registry transition only reconciles an existing component; missing, reserved, closed, or fenced slots are refused. It performs no new owner build or asynchronous wait. Complete routing and recovery admission are refreshed together. The read-only transaction is dropped synchronously after the callback, using the existing rollback-before-writer-release contract, with no post-publication await.

Initial and unchanged retained pins preserve their existing lifetime. Work settings retain their daemon-restart semantics: a durable commit after successful publication is allowed, while a superseded candidate cannot claim to be current at publication.

The existing real route-eviction/compiler-status journey now pauses candidate B, commits C through the actual configuration surface, resumes B and requires its typed refusal with installed A unchanged, then installs and verifies C. Existing assertions and budgets remain intact. Pinned formatting, whitespace checks, normal commit hooks, and independent source/authority/lock-order review passed. The complete native journey was not executed locally and must pass hosted CI.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 999c46d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[ScriptedAlchemy]

Independent source review at exact head e38c25d19a780067d4712268900854d7b7eaadd5 found two lifecycle gaps. This is not a runtime reproduction or a CI failure attribution.

1. Windows discovery selects tsc.cmd. The existing bounded runner kills/reaps only the direct wrapper, so its Node descendant can outlive cancellation, deadline or output refusal. Releasing compiler/CPU permits after that return does not establish actual compiler termination.
2. Dropping the async producer cancels its child token, but the detached blocking runner has no terminal join in project shutdown ownership. A project can report clean while queued or running compiler cleanup remains unsettled.

A separate correction worker is now implementing actual compiler supervision and project-owned terminal settlement with deterministic regressions. The dependent #4440 publication is held until the correction is reviewed and verified. No timeout increase, higher capacity, clean empty result, or branch rewrite is proposed. The existing local test report is preserved, but does not discharge these untested lifetime boundaries.